Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.
This release of Red Hat JBoss Data Virtualization 6.4.8 serves as a replacement for Red Hat JBoss Data Virtualization 6.4.7, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands (CVE-2016-5397)
tika-core: tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers (CVE-2018-1335)
slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)
jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307)
libthrift: thrift: Improper Access Control grants access to files outside the webservers docroot path (CVE-2018-11798)
jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022)
jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023)
jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718)
jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719)
jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360)
jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361)
jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362)
zookeeper: Information disclosure in Apache ZooKeeper (CVE-2019-0201)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.